v1.3.0 — correctness: live severity signal, portal resilience, honest audit surface

This release comes out of an adversarially verified quality audit. Full details in the changelog.

Fixed

• The thread-depth severity signal is live again. Thread bodies were never fetched, so every ticket scored thread_count: 0 and the severity term contributed nothing. The count now comes from the HelpScout list API's threads field, at no extra API cost. Note the semantics: it is the total thread count, including agent replies.
• One failing ProductLift portal no longer drops every portal's data; failures surface as per-portal warnings. A total fetch failure returns an error instead of an empty analysis that reads as success.
• Concurrent tool calls no longer interleave PII audit metadata (scrubbing itself was never affected).
• preview_only now describes exactly what is fetched and sent.
• Unparseable dates can no longer produce NaN scores; redaction placeholders can no longer surface as emerging themes; a malformed PRODUCTLIFT_PORTALS no longer kills the server at startup.

Changed

• get_feature_requests reports pii_scrubbing_applied / pii_categories_redacted like the other tools, and no longer sends commenter names (role only).
• Methodology bumped to v2.1: thread count clarified, plus a note that scores are normalized per call.

Internals

• New src/format.ts module, deduplicated response helpers, keyword regexes compiled once per analysis run, and 29 new tests (64 total).
• Transitive hono and qs advisories patched.

v1.2.0 — PM-first: discovery, triage, markdown briefs

PM-first release. Leads with the features that make day-to-day roadmap and signal work usable without dropping to the raw API; keeps the server read-only and privacy-focused.

Added

• list_sources — read-only tool listing connected HelpScout mailboxes (id + name) and ProductLift portals (name + url) so you can discover the names to pass elsewhere. Projects explicit fields; never returns API keys.
• mailbox_name on synthesize_feedback and generate_product_plan — resolves a mailbox name to its ID via a cached, paginated GET /v2/mailboxes lookup, so you no longer need internal IDs. mailbox_id still works and takes precedence.
• get_feature_requests now returns each request's public url and supports a case-insensitive status filter.
• generate_product_plan gains format: "markdown" — a ready-to-read product brief (ranked table + quotes). json stays the default for composability.
• Test suite for the scoring engine (feedback-analyzer.ts): theme matching, severity/vote-momentum scoring, convergence boost, sorting, emerging themes.
• scripts/call-tool.mjs + npm run tool — call a tool in isolation and print response byte size, without restarting your MCP client.

Changed

• McpServer version string corrected to match the package version.
• README: documented the new parameters/tool, fixed the credit-card redaction label to match the code ([CC REDACTED]), corrected per-tool output-size figures, and added Local testing + Troubleshooting sections.
• .gitignore now covers .env.* backups (keeps .env.example tracked).

Removed

• Orphaned fetchStatuses() / Status interface in productlift.ts.
• bin field in package.json — the package installs from source, not as an npm CLI.

Install: clone + npm install + npm run build (see README). Not published to npm.

Full changelog: https://github.com/dkships/pm-copilot/blob/main/CHANGELOG.md

v1.1.1

Patch over v1.1.0 cleaning up two things found during the npm publish dry-run.

Fixed

• Tarball no longer ships test files. tsconfig.json now excludes src/**/*.test.ts from compilation, so dist/pii-scrubber.test.* no longer lands in the published package. Tarball drops from 34 to 30 files (~13kB). Vitest still reads tests from src/ directly.

Changed

• README badges aligned with what's actually installed: TypeScript 6.0 and MCP SDK 1.29.0.

No source-level behavior changes, no API changes, no security changes. The full 1.1.0 feature set (security hardening + major dep bumps + Node 18 drop) carries through unchanged.

v1.1.0

First post-OSS-hardening release. Public API (MCP tools, resources, env vars) unchanged from 1.0.0; SemVer minor for the dropped Node 18 support and the new transparency of supply-chain hygiene.

Security

• npm audit now reports zero vulnerabilities at any severity (prod + dev). The 5 dev-only moderate advisories in the previous esbuild/vite chain were resolved by the vitest 4 upgrade.
• Patched 4 transitive runtime advisories via npm audit fix: fast-uri (HIGH path traversal + host confusion), hono (moderate bodyLimit/JSX/CSS/JWT/cache issues), ip-address (moderate XSS), express-rate-limit (moderate, inherited).
• Bounded the 429 retry loop in HelpScoutClient.apiGet — 3-retry cap with exponential backoff and Retry-After honoured.
• Fixed credit-card redaction regex in the PII scrubber. The previous pattern missed Amex's XXXX-XXXXXX-XXXXX shape; the new pattern matches any 13–19 digit run with separators, then defers to the Luhn check to filter false positives.
• Added SECURITY.md with disclosure path and PII posture.

Dependencies

• typescript 5 → 6
• vitest 2 → 4
• zod 3 → 4
• @types/node 22 → 25
• actions/checkout and actions/setup-node 4 → 6

Breaking

• Dropped Node 18 support. Node 18 hit end-of-life April 2025; modern dev tooling (vitest 4, rolldown, esbuild) no longer runs on it. engines.node and the CI matrix now require Node 20+.

Build and tooling

• Pinned tsconfig.json compilerOptions.types to ["node"] so TypeScript 6's implicit @types/* inclusion stays deterministic alongside vitest 4's new @types/chai/deep-eql/estree siblings.
• New 21-test vitest suite covering SSN, CC (Luhn pass/fail), email, and phone redaction.
• prepublishOnly gate runs build, tests, and npm audit --omit=dev --audit-level=high before publish.
• Project hardening for OSS: files allowlist, bin entry (pm-copilot), CI matrix on Node 20 + 22, Dependabot config, issue/PR templates, CONTRIBUTING.md, CODE_OF_CONDUCT.md.

Genericization

• Replaced client-identifying content (specific products, churn/scale figures, AppSumo-specific response filter) with generic illustrative examples so the public repo doesn't imply live customer data.

Full details in CHANGELOG.md.

v1.0.0

PM Copilot v1.0.0

MCP server that triangulates customer support tickets and feature requests to help PMs decide what to build next.

Tools

• synthesize_feedback — Cross-references HelpScout tickets and ProductLift feature requests, returns theme-matched analysis with priority scores
• generate_product_plan — Builds prioritized product plan with evidence and customer quotes. Accepts kpi_context from other MCP servers for composable prioritization
• get_feature_requests — Raw ProductLift data browsing across multiple portals

Key Features

• Signal triangulation: 16 configurable themes matched across both data sources
• Convergence scoring: Themes appearing in both support tickets AND feature requests get a 2x priority boost
• Three detail levels: summary (~19KB, LLM-optimized), standard (~68KB), full (~563KB)
• Response cache: 5-minute TTL so back-to-back tool calls share a single fetch
• PII scrubbing: SSN, credit card (Luhn-validated), email, phone — all redacted before analysis
• Agent response filtering: 30+ patterns prevent HelpScout agent text from contaminating customer quotes
• PM methodology: Opinionated scoring framework exposed as MCP resource (pm-copilot://methodology)
• Composability: Pass business metrics from Metabase, GA, or any source via kpi_context

Real Results

Tested against live data: 10,424 signals (10,195 support tickets + 229 feature requests) across 3 products in ~55 seconds. All 16 themes convergent.

Scoring Formula

priority = (frequency × 0.35 + severity × 0.35 + vote_momentum × 0.30) × convergence_boost

Quick Start

git clone https://github.com/dkships/pm-copilot.git
cd pm-copilot
npm install
cp .env.example .env   # Add your HelpScout + ProductLift credentials
npm run build